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FOREWORD 


This  report  Is  one  ol  a  series  oi  lour  prepared  lor  the  Avionics  Integrity 
Program  Of l ice,  Wright-Pat terson  Air  Force  Base,  Ohio.  The  reports  address 
techniques  and  historical  data  (lessons  learned)  for  enhancing  the  service  life 
of  avionic  systems.  The  reports  include  contractor  efforts  between  September 
1983  and  March  1984. 

Each  report  represents  a  completed  study  in  a  specific  area  and  stands 
alone.  However,  the  contents  of  the  four  reports  are  meant  to  complement  each 
other  and  they  should  be  considered  as  the  output  of  a  single  study  aimed  at 
determining  those  issues  which  contribute  to  the  avionics  integrity  of  military 
systems. 

The  titles  of  the  remaining  reports  and  their  respective  technical  report 
numbers  are  provided  as  follows: 

ASD-TR-84-5009,  AVIONICS  INTEGRITY  PROGRAM  (AVIP)  STUDIES:  Program 
Cost  Assessment  -  Environmental  Stress  Screening  and  Diagnostic 
Techniques,  Volume  III 

ASD-TR-84-5010,  AVIONICS  INTEGRITY  PROGRAM  (AVIP)  STUDIES:  Volume  I 
Procurement  Phase  Issues  -  Design,  Manufacturing,  and  Integration 

ASD-TR-84-5012,  AVIONICS  INTEGRITY  PROGRAM  (AVIP)  STUDIES:  Force 
Management  -  Economic  Life  Considerations,  Volume  IV 

These  reports  have  been  entered  into  the  DTIC/NTIS  system.  Contact  the 
Avionics  Integrity  Program  focal  point  ((513)255-3369)  to  obtain  the  appropriate 
report  number  for  ordering. 

The  authors  wish  to  acknowledge  the  cooperation  and  consideration  afforded 
to  them  by  Mr.  Thomas  Dickman,  Mr.  John  Kaufhold,  and  Major  Lee  Cheshire  of 
the  Avionics  Integrity  Program  Office  during  the  conduct  of  these  studies. 
Without  their  continuing  guidance  and  interest,  these  reports  could  not  have 
been  developed.  The  authors  would  also  like  to  thank  Mr.  Tom  Dolash, 

Mr.  Keith  Broerman,  Susan  Hendershot,  Nanci  Peterson,  and  the  Text  Processing 
Center  personnel  at  Battelle  Columbus  Laboratories  for  their  contribution 
to  these  reports. 


1.0  INTRODUCTION 


Case  studies  were  conducted  on  two  specific  avionics  processors,  the 
Delco  362F  and  the  IBM  AP-101C,  and  two  avionics  systems  which  utilize  these 
processors,  the  F- 16  and  B-52  Offensive  Avionics  System  (OAS),  respectively. 

The  objectives  of  these  case  studies  were  to: 

(1)  Collect  information  and  data  from  the  computer  manufacturers 
and  the  avionics  system  integrators  with  respect  to  their 
product  and  the  integrity  issues  associated  with  that  product. 

(2)  Analyze  the  information  and  data  collected  to  develop  an  evalu¬ 
ation  of  the  relative  merit  of  each  design,  manufacturing,  and 
integration  approach  method  for  specific  integrity  related 
activities. 

(3)  Identify  problems  encountered  by  the  manufacturers  and  system 
integrators  in  the  development  of  the  respective  subsystems  or 
systems. 

Visits  were  made  by  a  team  of  USAF  ASD/ENAS/AVIP  project  personnel 
and  Battel le  project  personnel  to  each  airborne  computer  manufacturer's 
facilities  to  interview  project  team  members,  review  and  observe  design  and 
manufacturing  methods,  procedures  and  processes,  and  to  collect  data  with 
respect  to  these  issues. 

The  system  integrators  were  visited,  by  the  same  team,  to  collect 
similar  information. 

The  resultant  data  were  then  analyzed  in  terms  of  identified 
activities,  sub-activities,  methodologies,  tools  and  their  impact  on  the 
various  integrity  attributes. 
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AIRBORNE  COMPUTER  DESIGN/MANUFACTURING 


Both  of  the  computers  studied  were  derivatives  of  earlier  designs. 

As  a  result,  the  machines  did  not  make  use  of  the  newest  technology  available. 
Both  manufacturers  used  core  memory  with  parity  (as  required  by  the  specifica¬ 
tions  developed  for  procurement  of  the  computer). 

A  synopsis  of  the  findings  of  the  case  studies  on  the  computers 

fol lows. 


1.1.1  F- 16  Fire  Control  Computer 


The  F- 16  Fire  Control  Computer  (FCC)  is  a  product  of  the  Delco 
Systems  Operation,  General  Motors  Corporation.  The  FCC  version  used  in  the 
F - 16  is  the  Delco  362F,  a  member  of  the  Delco  Magic  computer  family. 


1.1. 1.1  Design 


The  design  of  the  Delco  computer  was  a  derivative  of  earlier  Delco 
computer  designs.  The  history  of  the  362F  began  with  the  301  used  in  the 
Short  Range  Attack  Missile  (SRAM),  the  311  used  in  the  Delco  Carousel  IV 
inertial  navigation  system,  the  352  used  in  the  Titan  and  Delta  launch 
vehicles'  inertial  guidance  systems,  and  the  362  used  in  the  Navy  ATIGS. 


The  362F  design  was  performed  using  primarily  manual  methods. 

(Delco  prefers  to  convince  the  customer  that  they  can  meet  the  customer's 
requirements  with  an  existing  machine  with  as  few  design  and  manufacturing 
changes  as  possible.  Delco  then  modifies  the  design  to  meet  the  environment.) 


In  the  case  of  the  362F,  General  Dynamics  was  the  intermediate 
customer  with  the  USAF  the  final  customer.  General  Dynamics  wrote  the  speci¬ 
fications  in  response  to  USAF  requirements.  General  Dynamics  specified  use  of 
core  memory  and  floating  point  arithmetic. 


The  computer  architecture  and  instruction  set  were  designed  by 
Delco.  After  the  input/output  (I/O)  and  other  functions  were  defined,  the 
Delco  design  approach  moved  to  parts  selection. 


Delco  parts  selection  methods  differentiate  between  whether  the  item 
is  a  prototype  item  or  a  production  item.  Parts  derating  makes  use  of  Delco 
procedures  which  are  more  stringent  than  military  derating  procedures.  Every 
part  has  to  be  approved  by  the  Delco  parts  engineering  group  prior  to  release 
from  design.  Every  parameter  of  every  part  must  be  verified. 


Thermal  analysis  is  performed  using  a  nodal  model.  Estimated 
thermal  deltas  are  mapped  into  junction  temperatures.  (When  a  physical 
machine  is  available,  it  is  instrumented  by  the  same  person  who  did  the 
thermal  analysis,  to  collect  thermal  data  to  validate  the  design  analysis.) 
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Oelco  does  not  use  a  mathematical  model  for  vibration  analysis. 

Random  and  sinusoidal  vibration  is  used  by  Delco  in  design  verification  and  in 
qualification  testing.  Oelco  personnel  stated  that  sinusoidal  vibration  by 
itself  is  not  useful  for  test  screening. 

Every  part  must  be  electrically,  thermally,  and  environmentally 
acceptable.  Delco  uses  MIL-M-38510  qualified  parts  if  they  are  available. 

All  parts  are  subjected  to  three  temperature  tests  (high,  low,  and  ambient) 
with  power  applied  to  the  parts.  After  experience  is  gained  with  a  part, 

Delco  either  samples  parts  in  a  lot,  or  uses  a  single  temperature  screen  on 
100  percent  of  the  parts.  For  a  number  of  parts,  Delco  uses  three  point  temp¬ 
erature  tests  rather  than  the  temperature  cycle  since  they  feel  a  cycle  is  too 
expensive.  Delco  also  performs  a  destructive  test  and  a  life  test  on  the 
parts. 

Delco' s  experience  is  that  MIL-M-38510  parts  have  a  higher  accept¬ 
ance  rate  than  the  MIL-STD-883B  parts.  However,  Delco  also  stated  that  ven¬ 
dors  want  to  get  out  of  supplying  MIL-M-38510  parts.  Delco  has  an  acceptable 
supplier  list  (ASL)  and  also  uses  MIL-qual if ied  parts  lists.  Delco  requires 
their  ASL  to  perform  100  percent  test  and  burn-in  to  MIL-STD-883B  on  100  percent 
of  the  parts  Delco  buys. 

Delco  stated  that  DESC  allowed  vendors  to  make  Class  I  changes  to 
get  more  qualified  suppliers  without  changing  the  part  number.  As  a  result, 
Delco  first  screens  the  part  to  the  military  requirements  and  then  to  the  more 
severe  Delco  requirements. 

Delco  uses  the  LASAR  program  of  Teradyne  for  testability  analysis. 
Logic  simulation  programs  such  as  LASAR  are  required  by  General  Dynamics. 

Delco  personnel  did  not  know  whether  USAF  required  the  use  of  that  program. 

General  Dynamics  required  95  percent  fault  detection  and  95  percent 
fault  isolation.  Delco  negotiated  with  General  Dynamics  a  full  scale  develop¬ 
ment  goal  of  90  percent  with  growth  to  97  percent.  In  order  to  meet  the  test¬ 
ability  requirements,  they  must  be  considered  early  in  the  design  stage.  This 
benefits  Delco  at  the  card  level  testing.  Any  logic  change  necessitates  rerun 
of  the  LASAR  program. 

Incorporation  of  built-in  test  and  fault  isolation  necessitated 
redesign  of  test  equipment  used  by  Delco. 

Component  placement  is  done  on  new  Delco  designs  using  computer 
assisted  design.  Delco  uses  the  General  Electric  Calma  for  layout.  The  com¬ 
ponents  are  placed  using  x,y  coordinates  to  locate  the  integrated  circuits  and 
other  discrete  components  on  the  board. 


1.1. 1.2  Manufacturinc 


Upon  completion  of  the  board  layout,  the  parts  list  and  placement  of 
parts  are  transmitted  by  computer  to  the  layout  computer  at  Delco' s  Milwaukee 
manufacturing  facility.  This  facility  does  the  physical  fabrication  of  the 


1 1  -4 


boards.  Delco  performs  a  complete  inspection  and  environmental  test  program 
on  each  board.  The  failures  are  documented  in  a  formal  failure  reporting  sys¬ 
tem.  Each  failure  is  entered  into  a  data  bank  and  after  the  appropriate  design 
change  has  been  developed,  it  too  is  entered  into  the  data  bank  indicating 
what  was  fixed. 

The  cards  are  returned  to  the  Goleta  facility  and  assembled  into  the 
LRU  box.  The  pre-production  program  used  a  card  extender  with  a  thermal  hood. 
This  configuration  is  subjected  to  environmental  stress  screening  tests.  An 
environmental  test  program  is  loaded  into  the  computer  and  run  while  in  the 
chamber. 

The  F- 16  environmental  stress  screening  (ESS)  tests  were  based  on 
thermal  inertia  and  involved  a  -60°C  cold  soak  followed  by  a  turn-on  and  run 
for  6  hours  at  -40°C  followed  by  cycle  2  ambient  and  then  hot  soak  and  turn¬ 
on.  Oelco  performed  eight  ESS  cycles  for  the  F- 16  program. 

Ten  cycles  were  used  for  the  MADAR  for  the  C-5B.  The  last  4  cycles 
must  be  failure  free.  After  completing  the  above  sequence,  one  cycle,  which 
includes  random  vibration,  is  run  for  acceptance  tests.  Delco  will  not  use 
less  than  8  ESS  cycles. 

Delco  stated  that  the  LANTIRN  program  required  vibration  on  every 
cycle.  Delco  does  not  think  that  vibration  helps  screen.  The  combined  vibra¬ 
tion  and  temperature  does  not  help  screen.  Delco  runs  a  random  vibration  test 
at  one  temperature  on  the  boards.  The  type  of  ESS  test  and  qualification  test 
are  dependent  on  the  environment. 

The  production  program  cards  are  tested  using  a  hot,  ambient,  cold, 
ambient  powered  program  with  the  temperatures  5°  lower  and  10°  higher  than  the 
box  level  test.  Thermal  shock  is  not  part  of  the  acceptance  test. 

The  predicted  reliability  of  the  Delco  362F  is  between  2100  and  2200 
hours.  The  mean-time-between-repair  is  over  2500  hours.  Delco  stated  that, 
according  to  General  Dynamics,  the  mean-time-between-removal  is  much  less,  on 
the  order  of  600  to  700  hours. 

The  reliability  calculations  were  performed  by  Delco,  using  MIL- 
HD8K-217D  in  response  to  the  RFP.  Delco  then  modified  the  data  using  the  data 
base  prior  to  the  preliminary  design  review  (PDR)  and  critical  design  review 
(CDR).  Delco  stated  that  every  bidder  must  use  MIL-HDBK-217D  to  be  responsive 
to  the  RFP.  Delco,  as  previously  stated,  used  its  own  derating  criteria. 

Each  program  at  Delco  has  a  reliability  manager  and  all  reliability 
managers  report  to  a  system  effectiveness  manager.  The  quality  control/ 
assurance  manager  reports  to  the  plant  manager.  Delco  has  one  quality 
standard  but  each  program  has  its  own  reliability  standard. 


1.1. 1.3  Operations/Maintenance 


Delco  stated  that  they  do  not  receive  a  great  deal  of  feedback  from 
USAF  or  General  Dynamics  on  the  operational  experience  with  the  362F.  Delco 
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stated  that  every  software  error  causes  the  computer  to  be  pulled.  The  only 
software  in  the  machine  that  Delco  developed  is  the  operational  self-test 
software.  General  Dynamics  developed  the  rest  of  the  software.  Delco  stated 
that  a  lot  of  false  pulls  are  due  to  software  which  results  in  cannot  dupli¬ 
cate  (CND)  condition.  Delco  does  not  get  that  data.  It  was  suggested  by 
Delco  that  USAF  feedback  to  the  manufacturer  data  from  each  pull,  including 
when  it  was  pulled  and  why  it  was  pulled. 

The  latest  version  of  the  362F,  D^,  has  had  the  elapsed  time 
indicator  removed.  There  is  no  record  of  on  (operating)  time  or  flight  time 
on  these  computers.  Delco  does  not  think  this  is  a  good  policy. 

Delco  has  been  performing  the  repair  on  the  362F  computer.  The  USAF 
is  just  starting  to  make  the  transition  to  organic  maintenance  for  the  362F. 
Delco  is  concerned  that  they  will  get  no  feedback  information  once  the  transi¬ 
tion  to  organic  maintenance  is  completed.  In  order  to  apply  lessons  learned 
to  the  next  generation  computer,  it  is  important  that  both  the  user  and  the 
organization  performing  the  maintenance  feedback  information  to  the  manufac¬ 
turer  of  the  computer.  Computerized  data  bases  containing  this  information 
will  be  of  great  value  to  both  the  manufacturer  and  the  USAF  in  the  design  and 
manufacture  of  next  generation  computers.  This  may  be  the  only  form  of  cor¬ 
porate  memory  that  will  be  of  significant  use  in  future  designs  since,  as  in 
the  case  of  Delco,  the  original  design  team  personnel  have  moved  to  other 
projects  or  retired. 


1.1.2  B-52  Offensive  Avionics  System  (OAS)  Computer 

The  B-52  Offensive  Avionics  System  Computer  is  a  product  of  the  IBM 
Federal  Systems  Division.  The  computer  used  in  the  B-52  OAS  is  the  AP-101C,  a 
member  of  the  Advanced  System/4  Pi  Modular  Computer  Series. 


1. 1.2.1  Design 

The  design  of  the  AP-101C  computer  was  a  derivative  of  earlier  IBM 
computer  designs.  The  history  of  the  AP-101C  began  with  the  model  AP-1  used 
in  the  F-15.  The  AP-1  was  a  fixed  point,  hard  wired  control  machine  using 
modular  core  memory.  This  was  followed  by  the  AP-101B  used  in  the  NASA  F-8 
digital  fly-by-wire  program  and  the  space  shuttle  orbiter.  The  AP-101B  is  a 
floating  point  machine  using  microprogrammed  control. 

The  AP-101B  is  used  in  the  B-52  digital  bomb  navigation  system  and 
the  B-52G/H  Offensive  Avionics  System. 

The  central  processing  unit  (CPU)  for  the  AP- 10 1C  was  a  new  design. 
The  memory  was  not.  IBM  does  not  use  any  design  or  logic  checking  program 
1  ike  the  TEGAS  5. 

A  list  of  approved  digital  parts  that  have  been  characterized  at  the 
Manassas,  Virginia  facility  must  be  used  by  a  designer  unless  that  part  had 
been  approved  because  it  is  so  new.  The  new  part  must  be  characterized  before 


it  can  be  used.  Manassas's  personnel  look  ahead  to  see  if  a  part  is  becoming 
obsolete  and  characterize  a  proposed  replacement.  Manassas  also  identifies 
second  sources. 


The  schematic  layout  of  a  board  is  done  using  a  computer-aided 
design  (CAD)  system. 

IBM  uses  a  thermal  analysis  program  that  computes  the  heat  load, 
junction  temperatures,  etc.  The  CAD  may  be  used  to  adjust  the  design  as  a 
result  of  the  thermal  analyses.  The  thermal  analyses  include  power  dissipation 
considerations  and  cooling. 

IBM  uses  IBM  derating  factors  in  calculation  of  the  projected  relia¬ 
bility.  IBM  can  use  MIL-HDBK-217D  but  the  system  will  not  meet  the  reliabil¬ 
ity  requirements.  IBM  states  they  usually  have  to  convince  customers  that  IBM 
failure  rates  are  correct  and  they  can  meet  the  requirements. 

IBM  uses  qualification  levels  to  screen  parts.  IBM  suggested  that 
USAF  describe  the  actual  environment  the  computer  must  operate  in  rather  than 
calling  out  MIL-E-5400,  Class  2.  IBM  stated  that  qualification  test  levels 
are  not  necessarily  the  proper  level  for  incoming  parts  screening.  IBM 
requires  their  vendors  to  perform  100  percent  screening  to  at  least  MIL-M- 
38510.  IBM  then  samples  and  does  destructive  physical  analysis.  They  perform 
100  temperature  cycles  rather  than  the  ten  required  per  MIL-M-38510.  (IBM  has 
been  accused  of  wearing  parts  out.)  IBM  stated  that  they  do  not  pay  their 
suppliers'  overhead  that  a  MIL-M-38510  approved  supplier  charged. 


1,1,2.?  Manufacturing 

Upon  completion  of  the  part  selection  and  board  layout,  IBM  manufac¬ 
tures  circuit  boards  which  are  glass  epoxy  multi-layer  boards  with  five  or  six 
layers  and  power  and  ground  layers.  IBM  uses  dual  inline  packages  (DIPS) 
inserted  automatically  plus  surface  mounted  devices.  Wave  soldering  and  flow 
soldering  are  used  for  most  of  the  soldering.  Manual  soldering  is  used  for 
the  most  difficult  soldering.  DIPS  and  discrete  components  are  mounted  through 
the  board  while  flat  packs  are  surface  mounted.  IBM  puts  the  flat  pack  on  a 
P0G0.  The  operator  tweeks  the  alignment  and  then  it  is  automatically  sol¬ 
dered.  The  multi-layer  board  manufacturing  is  completely  automated.  IBM  uses 
low  ("zero")  insertion  force  connectors  with  seven  or  eight  bristles  per  pin. 

Subassembly  tests  in  the  factory  involve  plugging  the  multi-layer 
board  into  a  tester  which  has  200  different  programs.  Technicians  select  the 
correct  test  program  which  is  semi-automated.  Any  identified  failure  is  fixed. 
The  board  is  then  retested.  The  board  is  visually  inspected  and  a  conformal 
coating  applied,  followed  by  another  visual  inspection.  The  board  is  then  put 
into  stock. 

The  AP-101C  chassis  comes  assembled.  Shop  replaceable  units  (SRUs) 
are  removed  from  stock  and  a  unit  is  assembled  with  SRUs  pulled  from  stock. 


The  unit  is  subjected  to  ten  cycles  of  temperature  and  then  a  single 
axis  random  vibration  along  the  board  is  performed.  The  factory  test  program 
is  then  run.  IBM  then  reruns  the  ten  thermal  cycles  followed  by  random  vibra¬ 
tion.  The  unit  is  taken  up  to  71°C  (upper  temperature)  with  cooling  air 
applied.  This  takes  about  30  minutes.  The  unit  is  then  taken  down  to  -54°C 
for  the  lowest  temperature.  The  unit  is  cold  soaked  and  then  cold  started  and 
run  with  the  factory  test  program.  IBM  then  runs  the  temperature  to  71°C  and 
operates  the  unit  for  6-1/2  hours  with  power  on.  IBM  still  sees  hard  failures 
at  the  final  box  level  test  even  though  they  test  each  SRU  and  screen  the  parts 
before  assembling  them  into  an  SRU. 

IBM  takes  the  unit  out  of  factory  burn-in  and  puts  the  unit  into  a 
customer  specified  burn-in.  After  completion  of  that  test,  the  units  are 
painted  and  the  customer  acceptance  test  is  performed  at  room  temperature.  IBM 
allows  eight  weeks  for  final  testing  prior  to  customer  acceptance. 

IBM  believes  test,  analyze,  and  fix  (TAF)  needs  to  start  as  early  as 
possible.  The  problem  with  this  approach  is  the  competition  for  a  limited 
amount  of  test  equipment.  There  have  been  approximately  200  to  300  design 
changes  made  since  1978.  Approximately  60  percent  of  these  changes  are  logic 
design  changes  and  approximately  40  percent  are  manufacturing  changes.  A  PROM 
change  is  currently  underway. 

The  audit  trail  is  performed  manually  for  the  B-52  OAS  program.  IBM 
loses  track  of  "what  serial  number  page  is  in  what  unit"  once  it  leaves  IBM. 

The  as-built  list  is  on  the  facility  computer  system  at  IBM.  An  automated 
data  collection  system  which  tracks  where  each  SRU  is  would  be  useful.  The 
lot  number  and  day  code  indicate  the  pages  built  from  this  date  and  other 
dates.  IBM  does  an  individual  inspection  on  a  recall  to  check  if  it  has  a  day 
code  on  a  bad  chip. 

The  AP-101C  drawings  are  on  paper  and  were  done  manually.  The  B-1B 
computer  was  designed  using  CAD  and  the  drawing  information  is  stored  on  the 
computer. 


1. 1.2.3  Operations/Maintenance 

IBM  did  not  have  responsibility  for  the  avionics  system  software. 

IBM  provided  part  of  the  original  built-in  test  (BIT)  software  to  Boeing  who 
then  wrote  the  BIT  software  and  the  operational  flight  program  (OFP).  The 
United  States  Air  Force  intermediate  level  tester  is  a  Boeing  479  tester.  If 
Boeing  or  the  USAF  personnel  cannot  find  the  trouble  using  the  intermediate 
level  tester,  the  machine  is  sent  to  IBM.  IBM  receives  very  little  informa¬ 
tion  on  the  reasons  for  removal  of  the  processor.  If  Boeing  finds  a  faulty 
SRU,  they  replace  that  "page".  All  failed  pages  or  SRUs  are  repaired  by  IBM. 
Boeing/USAF  does  not  do  "page"  repair. 

Since  IBM  does  not  receive  information  for  the  reason  for  removal  of 
the  units,  more  money  is  spent  on  trying  to  find  troubles  that  retest  OK  than 
in  the  case  of  an  obviously  faulty  unit. 


The  demonstrated  mean-t ime-between-f ai lure  (MTBF)  of  the  AP-101C  is 
approximately  1600  hours  whereas  the  specification  was  1800  hours.  The  mean- 
t ime-between-removal  is  approximately  600  to  800  hours.  About  half  of  the 
removals  retest  OK.  IBM  stated  that  in  general,  comparing  the  specification 
data  and  the  field  data  is  like  comparing  apples  to  oranges.  The  aircraft 
time  is  the  flight  time,  while  the  total  time  on  the  elapsed  time  indicator 
on  the  AP-101C  is  the  ground  plus  flight  time. 

The  most  difficult  software  problems  are  showing  up  two  to  four 
years  downstream  after  introduction  of  a  processor.  The  manufacturer  needs 
data  on  the  problem  and  environment  at  that  time.  The  USAF  Boeing-provided 
tester  reloads  data  on  power-up;  therefore,  it  is  not  possible  for  IBM  to  get 
a  memory  dump  from  the  processor  which  has  failed  unless  the  machine  is  sent 
directly  to  IBM  where  they  use  their  own  tester.  I8M  believes  that  companies 
must  be  involved  :in  the  field  engineering  support  and  doing  the  failure 
analysis  and  reporting. 

IBM  stressed  the  need  to  spend  more  time  in  the  Concept  Definition 
Study  phase,  especially  for  a  major  procurement.  IBM  estimated  that  it  would 
take  approximately  one  year  to  do  the  job  properly.  In  addition,  IBM  stressed 
the  need  to  complete  all  of  the  evaluation  studies  very  early  in  the  design 
process.  In  the  case  of  the  AP-101C,  IBM  had  only  four  to  six  weeks  to 
conduct  the  Concept  Definition  Study. 

IBM  stressed  that  technology  infusion  does  not  work  unless  it  is 
part  of  pre-planned  product  improvement.  The  AP-101C  use  of  core  memory  is  an 
example.  The  core  memory  is  no  longer  being  manufactured  by  the  IBM  supplier. 
IBM  has  stockpiled  core  memory,  but  once  it  runs  out  of  the  stockpile,  a  new 
"page"  will  have  to  be  designed  to  meet  the  old  (present)  interface. 

In  1978,  IBM  committed  to  prices  through  1985.  Hardware  costs  can 
be  passed  through.  The  hardware  costs  have  decreased  over  time. 

IBM  would  like  to  see  the  USAF  implement  a  system  which  would  allow 
them  to  collect  data  on  each  failure  so  that  they  might  make  use  of  this  his¬ 
torical  information  in  design  of  the  next  generation  of  computers.  Implemen¬ 
tation  of  such  a  system  would  require  user  involvement  as  well  as  the  various 
Air  Force  Logistics  Command  (AFLC)  maintenance  organizations. 
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1.2  AVIONICS  SYSTEM  INTEGRATION 


The  system  integrators  using  the  Deico  362F  and  IBM  AP-101C  were 
visited  after  the  completion  of  the  computer  case  studies.  These  integrators 
were  General  Dynamics,  Fort  Worth,  Texas  (Deico  362F)  and  Boeing  Military 
Aircraft,  Wichita,  Kansas  (IBM  AP-101C). 

1.2.1  F-16  Avionics  System  Inteqration 

The  F-16  was  a  new  aircraft  for  which  the  Avionics  System  was 
designed  by  General  Dynamics,  Forth  Worth,  Texas.  The  Avionics  System  itself 
was  comprised  of  Government  Furnished  Equipment  (GFE)  and  avionics  developed 
specifically  for  the  F-16. 

1.2. 1.1  Design 

General  Dynamics  established  the  design  requirements  for  the  F-16 
Avionics  System.  The  system  was  designed  to  perform  both  the  air-to-air  and 
the  air-to-ground  mission. 

The  F-16  Avionics  System  architecture  is  based  upon  the  use  of  MIL- 
STD-1553  multiplex  data  bus  with  embedded  remote  terminals  in  most  of  the  Line 
Replaceable  Units  (LRUs).  Some  Government  Furnished  Equipment  (GFE)  avionics 
are  not  interfaced  with  the  multiplex  system.  Those  items  not  interfaced  with 
the  multiplex  include  the  communication,  radio  navigation,  and  identification 
subsystems. 

The  fire  control  computer,  the  Deico  Magic  362F,  performs  all  fire 
control  system  processing  including  control  of  the  multiplex  data  buses,  and 
energy  management,  air-to-ground  attack  computation,  and  air-to-air  attack 
computations. 

General  Dynamics  also  designed  and  manufactured  subsystems  which 
interface  with  multiplex  systems  including  the  store's  management  subsystem. 

General  Dynamics  was  given  the  requirements,  by  USAF,  for  the 
avionics  system  specifications.  The  systems  integration  plan  was  developed 
prior  to  full-scale  development.  General  Dynamics  worked  with  each  supplier 
to  make  sure  they  met  the  interfaces,  used  the  right  processes,  performed  the 
right  tests,  etc.  Then,  as  each  item  was  accepted  at  the  supplier's  facility, 
it  was  shipped  to  General  Dynamics  for  integration  with  General  Dynamics 
developed  software.  The  original  system  integration  was  performed  in  the 
systems  integration  laboratory  prior  to  full-scale  development,  or  there  being 
an  actual  aircraft  ready  for  integration  of  the  system. 

Each  subcontractor  runs  reliability  and  maintainability  (R&M)  tests 
witnessed  by  General  Dynamics  at  the  sub-contractor's  facility  using  test 
plans  furnished  by  General  Dynamics.  General  Dynamics  also  runs  R&M  test  on 
all  General  Dynamics  manufactured  items. 
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In  full-scale  development.  General  Dynamics  use  MIL-STD-781B  reli¬ 
ability  test  methods  including  sinusoidal  vibration.  Qualification  testing 
required  random  vibration.  General  Dynamics'  reliability  qualification  test 
(RQT)  was  carefully  designed  since  USAF  required  General  Dynamics  to  perform 
in  production  any  type  of  test  they  performed  during  RQT.  The  General  Dynamics 
RQT  is  not  the  same  as  the  USAF  test,  analyze,  and  fix  (TAF).  Ouring  RQT, 
random  vibration  was  used  only  on  the  radar  at  Westinghouse.  General  Dynamics 
does  not  think  sinusoidal  vibration  contributes  very  much  towards  screening  or 
stress  testing.  The  USAF  did  not  specify  or  require  RQT  or  burn-in  specifi¬ 
cally  as  General  Dynamics  did  it;  General  Dynamics  used  their  own  company 
procedures.  The  only  burn-in  required  on  the  hardware  is  that  necessary  to 
pass  RQT. 

General  Dynamics  stated  that  temperature  screens  are  good  only  if 
the  equipment  is  operating.  If  General  Dynamics  had  to  choose  between  temper¬ 
ature  screens  and  random  vibration  screens,  they  would  choose  a  temperature 

screen. 


General  Dynamics  buys  MIL-M-38510  or  MIL-STD-883B  parts.  General 
Dynamics  did  not  initially  do  any  incoming  screening.  This  resulted  in  17  to 
20  percent  failure  on  the  line.  General  Dynamics  went  to  an  independent 
laboratory  to  perform  screening,  using  a  high-ambient-low  temperature  screen 
and  rejected  4,950  out  of  5,000  parts.  General  Dynamics  is  now  screening  at 
the  piece  part  level.  General  Dynamics  feels  screening  should  be  optional  at 
the  Shop  Replaceable  Unit  (SRU)  level.  General  Dynamics  believes  that  if  the 
manufacture's  process  (soldering,  etc.)  is  controlled  and  piece  parts  are 
screened,  screening  is  not  required  at  the  SRU  level. 

General  Dynamics  said  that  the  Defense  Electronics  Supply  Center 
(DESC)  is  not  making  sure  that  MIL-M-38510  testing  is  being  fully  done  by 
manufacturers  of  components.  This  necessitates  additional  effort  on  the  part 
of  manufacturers  of  sub-systems. 

General  Dynamics  uses  MIL-STD-1965,  Piece  Parts  Control  and 
Standardization.  General  Dynamics  has  a  substitution  board  that  develops  a 
list  of  alternate,  valid  parts. 

General  Dynamics  stated  that  USAF  had  proposed  use  of  MIL-STD-781C 
for  the  reliability  testing  for  the  F- 16  MSIP. 


1.2. 1.2  System  Integration 

The  initial  integration  of  the  prototype  equipment  was  done  in 
General  Dynamics  System  Integration  Laboratory  (SIL).  Now  that  the  system  is 
in  production,  integration  is  performed  in  the  Avionics  Intermediate  Shop 
(AIS).  FIT  tests  are  done  on  a  continuing  basis.  AIS  engineering  tests  are 
also  performed  on  a  continuous  basis.  LRU  fault  insertion  is  performed  in  the 
Avionics  Intermediate  Shop  at  General  Dynamics.  General  Dynamics  also  has  a 
full-scale  mock-up  of  the  avionics  equipment  bay  and  cockpit  of  each  of  the 
F - 1 6  models  in  the  systems  integration  laboratory.  This  facility  is  used  for 
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software  integration  tests.  Full  system  integration  occurs  in  Avionics 
Electronics  Bay  ( AEB )  in  the  systems  integration  facility. 

Design  and  integration  problems  are  handled  using  the  test,  analyze, 
and  fix  ( TAF )  method.  General  Dynamics  said  the  problem  with  TAF  is  that  if 
money  is  short,  a  proper  fix  may  not  get  implemented.  General  Dynamics  does 
not  believe  that  an  RQT  should  be  performed  on  a  total  system.  While  the  sys¬ 
tem  is  under  General  Dynamics  control,  they  maintain  accurate  records  on  both 
hardware  and  software  faults.  General  Dynamic's  data  base  indicates  that  only 
approximately  10  percent  of  avionics  faults  are  software  related. 

The  F- 16  Avionics  System  has  implemented  sophisticated  diagnostic 
software  in  the  fire  control  computer.  Self-test  is  continuous  during  flight 
and  is  automatic.  The  built-in  test  (BIT)  interrupts  normal  operations,  and 
may  be  pilot,  or  ground-maintenance  crew  initiated.  General  Dynamics  stated 
that  the  test  BIT  gives  USAF  a  better  basic  product.  BIT  really  impacts 
design  integrity  according  to  General  Dynamics.  General  Dynamics  tried  to 
design  for  100  percent  self-test,  but  there  were  a  few  things  that  could  not 
be  done  that  made  them  back  down  to  95  to  97  percent  self-test.  The  diagnos¬ 
tic  software  in  the  fire  control  computer  has  no  correlation  with  the  software 
in  the  Avionics  Intermediate  Shop  (AIS).  The  General  Dynamics  developed  self¬ 
test  and  built-in  test  software  provides  both  a  pilot's  fault  list  and  a  main¬ 
tenance  fault  list.  The  maintenance  fault  list  provides  a  read-out  of  388 
failure  parameters. 

Once  a  system's  integration  was  completed  in  the  system's  integra¬ 
tion  lab,  the  system  was  then  installed  in  the  flight  test  aircraft  and  sub¬ 
jected  to  full-scale  development  testing.  During  that  time.  General  Dynamics 
provided  full  support  for  the  system. 


1.2. 1.3  Operations/Maintenance 

The  F- 16  avionics  changes  were  kept  to  a  minimum  from  the  initial 
design.  Over  1,000  systems  have  been  produced  and  are  in  operation. 

During  the  initial  operation  phase  a  four  year  mission-operation, 
test  and  evaluation  (MOT&E)  was  conducted  with  full  support  from  General 
Dynamics  personnel  in  the  field.  These  personnel  were  very  familiar  with  the 
design  of  the  hardware  and  software  of  the  system.  The  problems  encountered 
during  the  MOT&E  were  fed  directly  back  to  General  Dynamics  for  analysis  and 
determination  whether  an  engineering  change  proposal  (ECP)  was  needed.  Many 
of  the  problems  identified  in  the  field  dealt  with  operator  problems  as 
contrasted  with  hardware  and/or  software  design  problems. 

Now  that  General  Dynamics  personnel  are  no  longer  in  the  field 
supporting  the  system,  they  are  not  getting  feedback  of  the  information  they 
need  from  the  users  of  the  system.  The  USAF  personnel  are  not  filling  out  the 
documents  according  to  General  Dynamics.  General  Dynamics  receives  maintenance 
fault  list  (MFL)  data  only  from  Nellis  AFB,  through  informal  arrangements  and 
not  through  any  consistent  contractual  obligation  or  process. 


General  Dynamics  stated  that  they  can  obtain  information  from  the 
organization  and  the  intermediate  level  maintenance  but  they  can  not  obtain 
information  from  the  Depot  level.  General  Dynamics  stated  that  the  Depot 
repair  information  is  not  in  the  APR  66-1  maintenance  data  system.  General 
Dynamics  tracks  the  mean-time-between-maintenance  actions  types  1,  2,  and  6. 

General  Dynamics  would  like  to  see  the  APR  66-1  system  modified  to 
include  types  3,  4  and  5  for  software  faults.  Currently  there  is  no  way  to 
obtain  data  on  software  faults  except  with  a  man  in  the  field  at  every  base 
who  has  the  job  to  track  data.  A  good  engineer  on-site  can  break  out  failures 
in  terms  of  hardware,  firmware,  software,  and  operator.  General  Dynamics 
believes  that  the  maintenance  data  reporting  system  must  be  modified  to  handle 
these  additional  fault  categories.  In  addition,  LISAP  needs  to  change  its  pro¬ 
cedures  to  get  the  user  more  involved  in  helping  solve  some  of  the  maintenance 
problems  as  well  as  the  Depot  more  directly  involved  in  the  overall  problem. 

Once  a  system  reaches  maturity,  the  problems  are  subtle  hardware  and 
software  interaction  problems  such  as  "race  conditions. 11  The  only  way  that 
these  problems  can  be  isolated  is  through  an  engineer  who  knows  the  system  and 
has  available  the  proper  test  equipment  that  will  permit  the  determination  of 
the  causes  of  correlated  failures.  The  current  data  reporting  system  does  not 
permit  separating  the  maintenance  actions  into  hard  failures  versus  pilot 
squawks  which  are  not  hard  failures.  For  example.  General  Dynamics  stated 
that  the  pilots  want  as  accurate  an  inertial  navigation  system  as  possible 
when  they  are  being  scored  during  training  weapon  delivery  runs.  This  often 
results  in  the  pilot  requesting  that  the  inertial  navigation  system  be  removed. 
There  are  thirteen  types  of  errors  on  the  inertial  navigation  system  and  the 
USAF  data  system's  "HOWMAL"  (how  malfunction)  does  not  capture  all  these 
failures  and  fault  types.  As  a  result  the  INU  is  subjected  to  an  extensive 
test  and  calibration  taking  18  hours.  The  INS  removal  operation,  even  though 
the  unit  may  be  meeting  the  specifications,  is  counted  as  a  maintenance  action 
due  to  the  pilot  squawk. 

General  Dynamics  is  unable  to  track  the  shop  replaceable  units  (SRU) 
once  they  are  delivered  to  the  USAF.  USAF  personnel  remove  LRUs  and  then  swap 
SRUs  until  they  succeed  in  making  the  LRU  operational.  When  General  Dynamics 
finally  gets  an  LRU  back,  all  the  SRUs  in  it  are  bad,  in  many  cases,  none  of 
them  are  the  ones  that  were  originally  installed  in  that  LRU. 

General  Dynamics  stated  that  they  had  difficulty  in  tracking  the 
LRUs  and  presented  data  from  one  base  which  indicated  that  one  LRU  was  removed 
from  an  aircraft  and  subsequently  reinstalled  in  that  aircraft.  At  some  later 
date,  that  same  LRU  was  removed  from  another  aircraft  although  there  was  no 
record  that  it  had  been  removed  from  the  previous  aircraft  and  installed  in 
the  aircraft  that  it  was  subsequently  removed  from. 


General  Dynamics  cannot  provide  its  suppliers  data  on  SRU  faults 
since  General  Dynamics  does  not  have  that  data  furnished  to  it  from  USAF. 


The  data  provided  by  USAF  is  less  detailed  than  that  required  for 
today's  sophisticated  avionics  systems  which  rely  heavily  upon  software. 

While  the  avionics  system  was  designed  with  sophisticated  self-test  and  built- 
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in  test,  USAF  users  apparently  do  not  want  to  provide  the  maintenance  fault 
information  to  General  Dynamics.  General  Dynamics  had  proposed  that  the 
maintenance  fault  list  be  written  to  the  data  transfer  unit  (DTU)  for  the  F - 1 6 
C/D.  Maintenance  fault  list  information  could  then  be  dumped  from  the  DTU  and 
a  hard  copy  made  available  to  the  maintenance  personnel.  General  Dynamics 
stated  that  USAF  operational  personnel  did  not  want  the  maintenance  fault  list 
data  written  to  the  DTU,  since  the  DTU  also  contains  mission  data  such  as  way- 
points. 

USAF  personnel  have  also  directed  that  the  elapsed  time  indicators 
be  removed  from  the  next  batch  of  Delco  computers.  USAF  told  General  Dynamics 
that  sparing  was  based  on  the  flight  hours  and  events,  and  that  they  did  not 
intend  to  use  the  elapsed  time  indicators  even  if  the  device  was  on  the  box. 
USAF  told  General  Dynamics  that  the  elapsed  time  indicators  themselves  were  a 
source  of  unreliability.  Therefore,  General  Dynamics  incentive  is  now  based 
on  mean-time-between-demand  not  elapsed  time  on  the  box. 

Better  maintenance  statistics  are  required  in  order  to  effectively 
define  where  software  problem  areas  in  an  efficient  manner.  General  Dynamics 
stated  that  if  they  cannot  duplicate  (CND)  faults  as  measured  on  the  aircraft, 
it  does  not  result  in  a  box  being  taken  out  of  the  aircraft.  The  statistics 
that  are  accumulated  on  CND  include  recurring  faults  being  counted  multiple 
times  until  a  box  is  finally  removed.  Once  a  box  is  removed,  if  the  avionics 
intermediate  shop  cannot  find  anything  wrong  with  it,  it  is  declared  as  a 
retest  okay  (RTOK) . 

General  Dynamics  tracks  aborts  to  identify  those  subsystems 
contributing  to  the  aborts.  General  Dynamics  then  analyzes  those  subsystems 
to  determine  what  causes  the  failure  which  caused  the  abort.  If  corrective 
action  in  terms  of  design  or  manufacturing  processes  would  solve  the  problem. 
General  Dynamics  prepares  an  engineering  change  proposal. 

General  Dynamics  attempts  to  acquire  statistics  on  the  maintenance 
man/hours  spent  on  specific  line  or  shop  replaceable  units  per  maintenance 
event.  As  a  result  of  accumulating  this  type  of  information  by  base.  General 
Dynamics  determined  that  3  out  of  4  bases  were  charging  time  for  training  of 
maintenance  personnel  to  actual  maintenance  time.  This  type  of  data  is  useful 
since  incorrect  time  accounting  can  significantly  impact  the  decision  as  to 
whether  a  design  change  is  required  to  reduce  the  maintenance  time. 

General  Dynamics  data  indicates  that  the  F- 16  Avionics  System  is 
fairly  reliable.  They  currently  get  one  failure  parameter  from  the  mainte¬ 
nance  fault  list  per  10  sorties.  The  cost  of  failure  is  another  thing. 
Avionics  maintenance  cost  is  high  even  though  the  failure  rate  is  low. 

General  Dynamics  feels  that  these  costs  can  only  be  reduced  through  the 
introduction  of  improved  methods  for  accumulating  field  information  and 
identification  of  problem  areas  sooner  than  they  are  currently  identified. 

In  addition,  the  continued  use  of  Government  Furnished  Equipment,  which  is 
much  less  reliable  than  new  equipment  using  current  technology,  results  in 
significant  cost  and  impact  on  operational  readiness. 


General  Dynamics  does  not  believe  that  USAF  should  stock-pile  parts 
which  then  would  be  used  for  the  remaining  useful  life  of  the  system.  General 
Dynamics  believe  that  parts  deteriorate  in  storage.  They  believe  a  substitute 
part  should  be  used  if  a  part  is  no  longer  available.  This  requires  approval 
for  the  use  of  substitute  parts.  General  Dynamics  uses  a  parts  substitution 
board  which  provides  a  list  of  parts  that  may  be  substituted  for  parts  no  longer 
available. 

General  Dynamics  stated  that  better  data  collection  and  feedback  is 
needed  from  the  USAF  in  order  to  develop  and  maintain  avionics  system  in  a 
cost-effective  manner.  Both  depot  level  maintenance  procedures  as  well  as 
user  procedures  would  require  modification  in  order  to  provide  this  feedback. 
General  Dynamics  believes  that  as  the  USAF  proceed  to  two-level  maintenance 
(i.e.,  the  elimination  of  the  intermediate  level  maintenance),  the  USAF  will 
have  to  develop  improved  management  procedures  in  order  to  maintain  today's 
and  tomorrow's  complex  avionics  systems. 

1.2.2  B-52  Offensive  Avionics  System  (OAS)  Integration 


The  B-52  G/H  models  are  being  retrofitted  with  a  new  offensive 
avionics  system.  This  system  is  being  integrated  by  the  Boeing  Military 
Airplane  Company  in  Wichita,  Kansas,  and  makes  use  of  the  IBM  AP-101C 
Computer. 

1.2.2. 1  Design 

The  B-52  Offensive  Avionics  System  (OAS)  was  designed  by  Boeing  Mil¬ 
itary  Airplane  Company  (BMAC)  in  response  to  SAC  ROC  6-75  with  the  support  and 
direction  from  the  USAF  and  COD  as  well  as  information  from  avionics  com¬ 
panies.  The  OAS  system  architecture  makes  use  of  the  MIL-STD-1553A  data  bus 
to  integrate  the  pair  of  AP-101C  computers  with  the  controls  and  display  sub¬ 
system  and  the  navigation  and  guidance  subsystem,  both  of  which  were  specified 
by  Boeing  Military  Airplane  Company.  In  addition,  the  data  bus  interfaces 
with  existing  B-52  equipment  and  the  weapon  control  and  delivery  equipment. 

Boeing  Military  Airplane  Company  wrote  the  processor's  specification 
b >sed  upon  the  system  requirements  such  as  those  dictating  non-volatile  memory 
and  the  nuclear  hardness  requirements  of  AFR-122-10.  Boeing  Military  Airplane 
Company  stated  that  the  AP-101C  was  really  a  new  machine,  even  though  its 
architecture  was  based  on  the  4-Pi  family. 

Boeing  Military  Airplane  Company  stated  the  original  specifications 
for  the  OAS  ask  for  capability  and  flexibility  that  USAF  wasn't  willing  to  pay 
for  once  they  found  out  how  much  it  was  going  to  cost.  Boeing  Military 
Airplane  Company  stated  that  USAF  had  to  delete  some  requirements  and  then 
later  wanted  them  back  in. 

Boeing  Military  Airplane  Company  stated  that  since  the  program  began 
in  1978  there  had  been  three  changes  in  SAC  personnel,  and  this  resulted  in 


changes  in  requirements  since  each  person  interpreted  the  requirements 
differently  than  their  predecessors. 


Very  few  modifications  were  made  to  the  specifications  once  IBM  was 
selected  as  computer  contractor.  The  one  modification  that  Boeing  Military 
Airplane  Company  could  identify  was  the  power  interrupt  test. 

Boeing  specified  the  Quality  Assurance  (QA)  test  and  burn-in. 

Boeing  Military  Airplane  Company  Systems  Engineering  established  the  test 
requirements,  while  a  separate  test  organization  wrote  the  individual  test 
plans.  Boeing  Military  Airplane  Company  wrote  an  integration  test  plan  based 
on  when  they  wanted  hardware  delivered.  Boeing  Military  Airplane  Company  also 
developed  a  compatibility  test  plan. 

A  CPU  tester  was  acquired  from  IBM.  Boeing  Military  Airplane  Com¬ 
pany  used  this  tester,  but  did  not  provide  this  tester  to  the  USAF.  Boeing 
Military  Airplane  Company  Systems  Engineering  supplied  the  operational  support 
equipment.  During  full-scale  development,  there  was  no  support  equipment. 
There  were  also  no  technical  orders.  Boeing  built  test  support  equipment  for 
the  support  of  the  full-scale  development  (FSD).  This  equipment,  while 
actually  owned  by  USAF,  was  retained  by  Boeing.  This  is  not  the  equipment 
used  to  support  the  operational  system. 

The  Boeing  479  test  set  supports  the  operational  AP-101C.  The  ini¬ 
tial  479  test  set  had  no  capability  to  dump  the  AP-10IC  memory.  The  479  test 
set  now  has  the  capability  to  dump  the  memory,  but  runs  self  tests  once  it's 
turned  on  and  the  memory  is  overwritten. 

The  built-in  test  (BIT)  software  for  the  AP-101C  was  written  by 
Boeing  Military  Airplane  Company.  The  specification  was  that  BIT  had  to 
detect  95  percent  of  the  faults,  isolate  75  percent  of  the  faults  to  the  LRU, 
and  that  there  had  to  be  less  than  a  5  percent  false  alarm  rate. 

Boeing  has  their  own  list  of  qualified  suppliers.  Boeing  performs 
a  100  percent  screen  on  incoming  parts.  They  do  not  rely  upon  the  Defense 
Electronics  Supply  Center  (DESC)  and  the  Qualified  Parts  List  (QPL) . 

Individual  equipment  is  subjected  to  temperature,  altitude  vibration 
and  an  electromagnetic  compatibility  test  prior  to  systems  integration. 


1.2. 2. 2  Systems  Integration 

The  8-52  OAS  consists  of  a  total  of  44  new  units,  47  units  that  were 
previously  on  the  B-52,  and  5  units  which  were  on  the  B-52  but  modified.  The 
integration  of  the  new  units  is  the  principal  thing  that  occurs  in  the  Systems 
Integration  Laboratory  Test  Facilities  (SILTF).  Prior  to  implementing  the 
integration  according  to  the  integration  plan,  each  box  must  have  completed 
its  compatibility  test  as  well  as  the  cable  use  tests.  The  SILTF  cables 
typically  aren't  the  same  as  those  actually  used  in  the  aircraft  according  to 
Boeing  Military  Airplane  Company.  Boeing  Military  Airplane  Company  stated 
that  the  pre-production  hardware  is  still  in  the  SILTF.  These  prototypes  will 


not  be  replaced  with  production  hardware  since  no  money  has  been  allocated  by 
USAF  to  pay  for  the  replacement  system.  In  the  SILTF,  Boeing  integrated  the 
hardware  item  by  item  and  simulated  the  weapon  system  interfaces  and  B-5 2 
existing  aircraft  interfaces  with  the  OAS.  The  OAS  software  and  hardware  were 
integrated  in  a  sequence  as  prescribed  in  the  integration  plan. 

Boeing  Military  Airplane  Company  has  constantly  upgraded  the  SILTF 
to  emulate  the  aircraft  itself. 

Boeing  Military  Airplane  Company  performed  a  reliability  burn-in  of 
the  pre-production  units.  They  did  not  find  the  problems  that  they  subse¬ 
quently  did  in  the  Test,  Analyze  and  Fix  (TAF)  on  the  production  items. 

Boeing  Military  Airplane  Company  stated  that  the  qualification  test  purpose  is 
to  find  out  if  the  design  is  good.  Qualification  testing  occurs  prior  to  pro¬ 
duction.  Boeing  Military  Airplane  Company  personnel  do  not  believe  that  burn- 
in  helped  that  much. 

Production  hardware  was  being  built  on  the  B-52  OAS  prior  to  the 
start  of  Full-Scale  Development  (FSD).  During  the  Full-Scale  Development, 
Boeing  performed  a  Test,  Analyze  and  Fix  (TAF).  During  the  TAF,  the  complete 
system  was  never  subjected  at  one  time  to  a  complete  test  due  to  environmental 
facility  limitations,  etc.  The  individual  boxes  were  tested  and  a  number  of 
subsystems  were  operated  as  integrated  subsystems.  Boeing  Military  Airplane 
Company  kept  records  on  the  time  on  the  LRUs  and  the  cause  of  the  failure. 

When  failures  occurred,  they  fixed  the  failed  item  to  the  original  design 
documents  while  they  analyzed  the  failure  and,  in  the  case  of  many  of  the  same 
failures,  they  initiated  a  redesign.  After  another  failure,  Boeing  Military 
Airplane  Company  implemented  the  design  change  when  the  design  change  was 
ready;  otherwise  Boeing  Military  Airplane  Company  restored/fixed  the  system  to 
the  original  system  design,  and  continued  testing.  The  TAF  was  performed  for 
a  total  of  six  months. 
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Boeing  Military  Airplane  Company  stated  that  TAF  isn't  to  fix  a 
design.  TAF  is  to  find  and  fix  production  problems.  The  TAF  for  the  B-52  OAS 
avionic  systems  found  problems  even  after  FSD  was  complete. 

Boeing  Military  Airplane  Company  stated  if  TAF  is  done  when  USAF  has 
Class  I  Control,  they  will  get  something  useful.  TAF  prior  to  when  the  USAF 
has  control,  leaves  the  door  open  for  any  kind  of  uncontrolled  change.  Boeing 
Military  Airplane  Company  feels  that  the  use  of  TAF  earlier  in  the  system  life 
cycle  will  not  be  cost  effective. 


1.2. 2. 3  Operation/Maintenance 

Boeing  Military  Airplane  Company  stated  that  every  Air  Force  base  is 
different  as  to  how  the  computer  is  used.  Some  bases  just  reload  in-flight  in 
case  of  a  failure.  Others  take  the  computer  to  the  shop  and  then  return  it  to 
use.  The  majority  of  computer  failures  are  transient  type  failures. 


8oeing  Military  Airplane  Company  provided  information  on  a  design 
change  that  has  occurred  since  the  OAS  was  made  operational.  The  first  Air 


Force  base  having  the  OAS  had  no  processor  problems.  The  second  Air  Force 
base  had  no  processor  problems.  The  third  Air  Force  base  to  receive  the  OAS 
had  all  types  of  processor  problems.  Each  base  received  later  serial  numbers 
of  the  system.  The  problems  that  occurred  at  the  third  base  were  determined 
to  be  due  to  a  software  change  made  after  deliveries  to  the  first  and  second 
bases;  and  this  change  affected  only  systems  delivered  to  the  third  base.  The 
problem  was  a  "race"  condition  when  data  was  pulled  from  the  Read  Only  Memory 
(ROM).  This  problem  was  reported  as  a  parity  error.  IBM  ran  their  test 
software  and  the  box  tested  OK.  The  Boeing  software  caused  the  problem,  which 
was  a  hardware  item,  to  manifest  itself.  Boeing  isolated  the  problem,  but  it 
actually  required  a  full  up  system  with  Boeing  software  to  cause  a  problem  to 
be  manifested.  IBM  was  required  to  fix  the  problem,  since  their  hardware  was 
the  source  of  the  problem. 

Boeing  Military  Airplane  Company  stated  that  the  hardware  is  very 
reliable.  They  have  had  three  aborts  due  to  OAS  failures  in  30,000  flying 
hours.  Software  errors  are  small  compared  to  the  number  of  human  operator 
errors.  Boeing  Military  Airplane  Company  stated  that  they  have  had  problems 
in  which  the  USAF  operators  tried  to  load  more  waypoints  than  the  software  was 
designed  to  handle.  Since  the  Technical  Order  did  not  address  this,  the  USAF 
operators  assumed  that  they  could  load  as  many  waypoints  as  they  wished  to. 
Boeing  Military  Airplane  Company  proposed  that  better  Technical  Orders  would 
reduce  human  operator  errors  of  this  type. 

Boeing  Military  Airplane  Company  recommended  that  more  time  (and 
money)  be  devoted  to  testing.  A  number  of  problems  which  should  have  been 
caught  early  in  the  development  phase  were  not  caught  until  later  because 
extensive  testing  was  not  performed.  Boeing  Military  Airplane  Company 
believes  that  if  USAF  wants  to  have  integrity,  they  must  be  willing  to  pay 
for  the  testing.  Boeing  Military  Airplane  Company  stated  that  the  USAF  must 
really  decide  how  much  risk  they  want  to  take.  The  Test,  Analyze  and  Fix 
(TAF)  program  on  the  B-52  OAS  provided  engineering  information  on  the  failure 
modes,  mechanisms  and  rates  of  a  test  item  under  natural  and  induced  environ¬ 
mental  conditions  of  military  operations.  Boeing  Military  Airplane  Company 
believes  that  this  resulted  in  the  prevention  of  the  recurrence  of  failures 
due  to  incorporation  of  corrective  action. 


1.3  CASE  STUDIES  CONCLUSIONS 


An  analysis  of  the  information  collected  from  the  two  computer 
manufacturers  and  two  systems  integrators  resulted  in  the  following  findings: 


•  Computer  test  equipment  that  is  used  by  the  computer  manufac¬ 
turer,  while  available  to  the  systems  integrator,  is  generally 
not  used  by  the  systems  integrator  except  at  his  own  facility. 

The  systems  integrator  provides  USAF  computer  test  equipment  that 
is  of  a  different  design  and  either  manufactured  by  the  systems 
integrator  or  by  another  subcontractor,  but  not  by  the  computer 
manufacturer.  This  results  in  problems  in  duplicating  test 
results  when  the  computer  is  returned  to  the  computer  manu¬ 
facturer. 

•  The  systems  integrator  uses  little  or  no  software  that  the 
computer  manufacturer  uses  or  provides  to  the  systems  integrator. 
The  systems  integrator  typically  develops  the  built-in  test  and 
fault  isolation  test  software  for  the  system.  The  only  portion 
of  the  software  provided  by  the  computer  manufacturer  which  may 
be  used  by  the  systems  integrator  is  the  computer  self -test 
software. 

•  The  state-of-the-art  built-in  test/fault  isolation  hardware  and 
software  apparently  is  not  fully  utilized  by  the  USAF  user.  The 
information  available  from  this  state-of-the-art  system  is  not 
provided  to  the  systems  integrator  or  to  the  computer  manufac¬ 
turer  by  the  USAF.  If  state-of-the-art  BIT  is  not  currently 
used,  it  must  be  asked  if  the  more  sophisticated  BIT  and  FIT  will 
be  used. 

•  USAF  does  not  collect  data  that  would  be  useful  to  improve  the 
design  of  future  avionics  and  the  integration  of  those  avionics 
to  the  subsystem  manufacturers  and  the  systems  integrators.  The 
limitations  of  manual  data  collection  procedures  and  existing 
data  bases  must  be  removed  by  the  implementation  of  automated  or 
computer  controlled  procedures  and  techniques.  These  automated 
or  computer  controlled  systems  can  be  used  to  collect  and  feed 
back  the  information  required  by  the  manufacturers  of  the  sub¬ 
systems  (as  well  as  the  system  integrators)  in  a  format  that  is 
both  timely  and  complete. 

•  Both  the  Delco  computer  and  the  IBM  computer  had  nearly  equivalent 
predicted  mean-time-between-fai lure-rates.  The  Delco  computer 
had  a  predicted  MBTF  of  2100-2200  hours  and  the  IBM  computer  had 

a  predicted  MTBF  of  1800  hours.  For  the  Delco  computer  the  actual 
mean-time-between-fai lure  (MTBF)  was  over  2500  hours,  whereas  the 
IBM  computer  had  a  demonstrated  MTBF  of  1600  hours.  In  both  cases, 
however,  the  mean-time-between-removals  (MTBR)  was  significantly 
less  than  the  repair  or  failure  rates.  The  MTBR  was  600-700  hours 
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for  the  Del co  computer  and  was  600-800  hours  for  the  IBM 
computer,  lable  II-1.3-1  shows  these  data. 


TABLE  II-1.3-1.  Comparison  of  Failure  and  Removal 
Rates  for  the  Delco  and 
IBM  Computers 


Delco  362f 

IBM  AP101C 

MTBF 

(Predicted) 

2100-2200 

1800 

MTBF 

(Demonstrated) 

2500 

1600 

MTBR 

600-700 

600-800 

It  can  be  seen  from  the  data  obtained  in  these  studies  that: 

(a)  The  manufacturers  used  more  rigorous  parts  selection 
criteria  than  that  which  was  required  in  order  to 
obtain  the  "best"  parts  for  use  in  the  avionic  system. 

(b)  In  both  cases  (Delco  and  IBM),  environmental  stress 
screening  was  used  to  insure  that  the  infant  and  latent 
defects  were  removed  prior  to  submitting  the  parts  to 
the  manufacturing  process.  However,  it  was  not  used 
extensively  on  sub-assemblies  or  assemblies. 

(c)  In  both  cases  (Delco  and  IBM),  final  acceptance  testing 
was  performed  at  the  system  level  (in  environmental 
chambers)  until  the  units  performed  failure  free  for  a 
specified  number  of  hours  under  thermal  cycling  and 
full  power. 

From  these  data,  it  can  be  inferred  that  the  "good"  performance  of 
the  field  product,  in  the  operational  environment,  (reference  table  II-1.3-1) 
was  due  to  the  application  of  the  identified  tools  and  methodologies 
during  the  initial  design  and  construction  of  the  system  level  product. 
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1.4  CASE  STUDY  RECOMMENDATIONS 


These  case  studies  were  primarily  directed  at  the  subsystem  manu¬ 
facturer  and  the  systems  integrator.  It  is  recommended  that  the  case  studies 
be  extended  to  include  a  study  of  the  users  and  each  of  the  maintenance  levels 
for  the  F - 16  avionics  system  and  the  B-52  offensive  avionics  system.  Infor¬ 
mation  collected  in  these  extended  case  studies  would  be  most  useful  to  the 
USAF  in  determining  needed  improvements  to  the  maintenance  data  collection  and 
distribution  procedure.  The  proper  feedback  from  this  improved  procedure 
would  result  in  increased  avionics  integrity  due  to  the  manufacturers'  and  the 
systems  integrators  ability  to  understand  and  correct  problems  in  a  more 
timely  manner  due  to  the  fact  they  will  have  been  provided  the  proper 
information  and  data  in  a  reliable  and  complete  data  base  as  soon  as  it  occurs 
or  is  generated. 
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